Amendments to the Claims 



1 . (original) A method of establishing a consistent password policy, 
said method comprising: 

describing a plurality of password policies in a computer usable password 
policy data structure; 

accessing said computer usable password policy data structure by a 
password policy enforcement agent; and 

enforcing at least one of said plurality of password policies described 
within said password policy data structure by said password policy enforcement 
agent. 

2. (currently amended) The method of Claim 1 wherein said computer 
usable password policy data structure comprises a file structure substant i a ll y 
compatible with extensible markup language. 

3. (original) The method of Claim 1 wherein said password policy 
enforcement agent is operable on a client computer of a client-server computer 
system. 

4. (currently amended) The method of Claim 1 wherein said method 
is operable on a utility data center. 
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5. (original) Tlie method of Claim 1 further comprising validating said 
computer usable password policy data structure for authenticity by said password 
policy enforcement agent. 

6. (original) The method of Claim 1 wherein said plurality of password 
policies comprises a threshold parameter for unsuccessful access attempts that 
when exceeded disables a computer system access account. 

7. (currently amended) The method of Claim 6 wherein said plurality 
of password policies comprises a parameter Indicating the-a time duration , and 
wherein exceeding said threshold parameter with i n wh i ch sa i d throchnld 
param o t o r number of unsuccosoful acooss attempts triggers locking of a 
computer system access account within said time duration . 

8. (original) The method of Claim 1 wherein said plurality of password 
policies comprises an initial delay parameter to block access to a computer 
system access account for a period of time after an unsuccessful access attempt. 

9. (currently amended) The method of Claim 8 wherein access to 
said computer system access account is delayed for an increasing time period 
for successive unsuccessful access attempts. 
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10. (original) The method of Claim 1 wherein said plurality of password 
policies comprises a minimum password length parameter. 

1 1 . (original) The method of Claim 1 wherein said plurality of password 
policies comprises a maximum password length parameter. 

12. (currently amended) The method of Claim 1 wherein said plurality 
of password policies comprises a_paramete r to prohib i t passwords cons i oting of a 
natural l anguag e word for prohibiting passwords comprising a word associated 
with a natural lanouaoe . 

1 3. (currently amended) The method of Claim 12 f fl ]]whereln said 
natural language is English. 

14. (currently amended) The method of Claim 1 wherein said plurality 
of password policies comprises a_parameter for prohibiting t o prohibit passwords 
comprising cons i sting of a palindrome. 

15. (currently amended) The method of Claim 1 wherein said plurality 
of password policies comprises a parameter for prohibiting t o proh i bit passwords. 
comprising cons i sting of a derivative of a computer system account name. 
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16. (currently amended) The method of Claim 1 wherein said plurality 
of password policies comprises a.parameter foLte-automatically generating 
g e norato a password. 

1 7. (currently amended) The method of Claim 1_[[1 6 ]]wherein said 
plurality of password policies comprises a_parameter foLte-automatically 
generating g e n e rate a pronounceable password consistent with al l of said 
plurality of password policies. 

1 8. (cun-ently amended) The method of Claim 1_[[1 6 ]]wherein said 
plurality of password policies comprises a_parameter for specifying t o spocify a 
set of characters utilizable to automatically generate a password. 

1 9. (cun-ently amended) The method of Claim 1 further comprising 
providing, by said password policy enforcement agent, feedback to a 
configuration and aggregation point, about whether said at least one of said 
plurality of password oolicies w h i ch of oa i d p l urality of pnF.Rwnrri pn li n in r . h . m n 
has been successfully enforced. 

20. (cun-ently amended) A computer usab l o pacsword po li cy data 
structuro compris i ng computor accoss pa c sword pol i cy paramotoro. 
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Instructions on a computer usable medium wherein. the instructions when 
executed cause a computer system to perform a method of establishing a 
consistent password policy, said method comprising: 

describing a plurality of password policies in a computer usable password 
policy data structure: 

proyiding an access point with access to said computer usable password 
policy data structure: and 

receiying feedback from a password policy enforcement agent associated 
with said access point about which of said plurality of password policies haye 
been successfully enforced. 

21. (currently amended) The computer usable medium of Claim 20 
wherein said computer usable password policy data structure of C l aim 20 
compr i s i ng comprises a file structure substantia ll y compatible with extensible 
markup language. 

22. (currently amended) The computer usablo password po l icy data 
structure of C l aim 20 comprising a comput e r access password po li cy paramotor 
s ele ct e d from th e s e t of comput e r acc e ss password policy par a met e r s 
compr i s i ng computer usable medium of Claim 20 wherein said method further 
comprises : 

selecting a computer access password policy parameter from said plurality 
of computer access password policy parameters consisting of a parameter 
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selected from a group of parameters comprising a threshold parameter for 
unsuccessful access attempts that when exceeded disables a computer system 
access account[[:]La parameter indicating the a time duration within which said 
threshold parameter number of unsuccessful access attempts triggers locking of 
a computer system access account[[;]]i.an initial delay parameter to block access 
to a computer system access account for a period of time after an unsuccessful 
access attempt[[;]La minimum password length parameter[[;]La maximum 
password length parameter[[;]La parameter to prohibit passwords consisting, of a 
natural language word[[;]La parameter to prohibit passwords consisting of a 
palindrome[[;]La parameter to prohibit passwords consisting of a derivative of a 
computer system account name[[;]La parameter to automatically generate a 
password [[;]La parameter to automatically generate a pronounceable password 
consistent with all of said plurality of password policies[[;]Land a parameter to 
specify a set of characters utilizable to automatically generate a password. 

23. (cun-ently amended) A computer system comprising: 

a computer usable password policy data structure comprising a plurality of 
password policies; and 

a server configured to provide access to said computer usable password 
policy data structure at an access point configured to enforce at least one of said 
plurality of password policies using a password policy enforcement agent. 

a first s e rv e r computer for contro l ling a cc e ss to sa i d computer systom - 
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a s e cond s e rv e r computer coup l ed to sa i d f i rst sorvor computor for 

prov i d i ng contro l of sa i d computor syst e m; 

computer usab l e modia compr i s i ng comput e r usab l e i nstructions than 

wh e n ex e cut e d on a proc e ssor of sa i d first s e rv e r comput e r i mp l om e nt a m e thod 
of e stab li sh i ng a cohs i st e nt password po li cy, s a i d m e thod compris i ng: 

acc e ss i ng a computor usab l o password pol i cy data structur e ; and 

e nforc i ng a password po li cy described w i thin sa i d password po l icy data 

structure. 

24. (original) The computer system of Claim 23 comprising a utility 
data center. 
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